The goal would be for the system to trigger an event anytime someone typed in PCI or PII to OneNote. Being that OneNote doesn’t save like a normal file I can’t get it to detect.

The first requirement is to add an application to application monitoring.

Make changes to the way OneNote is optimizing:

1. ​Change the % of unused space to allow in files without optimizing to 0%.
2. Make sure to select optimize files after OneNote has been inactive for 1 minute. 

https://blogs.msdn.microsoft.com/johnguin/2009/07/16/responding-to-a-question-in-a-tweet/